by symgraph
An native MCP server extension for Ghidra
# Add to your Claude Code skills
git clone https://github.com/symgraph/GhidrAssistMCPGuides for using mcp servers skills like GhidrAssistMCP.
Last scanned: 5/11/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-05-11T07:43:56.304Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
Top skills in this category by stars
30 days in the Featured rail · terms & refunds
A powerful Ghidra extension that provides an MCP (Model Context Protocol) server, enabling AI assistants and other tools to interact with Ghidra's reverse engineering capabilities through a standardized API.
GhidrAssistMCP bridges the gap between AI-powered analysis tools and Ghidra's comprehensive reverse engineering platform. By implementing the Model Context Protocol, this extension allows external AI assistants, automated analysis tools, and custom scripts to seamlessly interact with Ghidra's analysis capabilities.
program_name parameterShameless self-promotion: GhidrAssist supports GhidrAssistMCP right out of the box.

Download the latest release:
.zip file (e.g., GhidrAssistMCP-v1.0.0.zip)Install the extension:
Enable the plugin:
Clone the repository:
git clone <repository-url>
cd GhidrAssistMCP
Point Gradle at your Ghidra install:
GHIDRA_INSTALL_DIR (environment variable), or pass -PGHIDRA_INSTALL_DIR=<path> when you run Gradle.Build + install:
Ensure Ghidra isn't running and run:
gradle installExtension
This copies the built ZIP into your Ghidra install ([GHIDRA_INSTALL_DIR]/Extensions/Ghidra) and extracts it into your Ghidra user Extensions folder (replacing any existing extracted copy).
If you need to override that location, pass -PGHIDRA_USER_EXTENSIONS_DIR=<path>.
Restart / verify:
Open the Control Panel:
Configure Server Settings:
localhost8080The Configuration tab allows you to:
GhidrAssistMCP can also be started from Ghidra's analyzeHeadless launcher. This is useful when you want MCP access to a program loaded in headless Ghidra without opening the CodeBrowser UI.
First, build and install the extension so Ghidra can load the compiled classes and bundled dependencies:
cd /path/to/GhidrAssistMCP
export GHIDRA_INSTALL_DIR=/path/to/ghidra_12.0_PUBLIC
gradle installExtension
Set paths for your Ghidra install and extracted user extension. On Linux, Ghidra user extensions usually live under ~/.config/ghidra/<ghidra_profile>/Extensions:
export GHIDRA_INSTALL_DIR=/path/to/ghidra_12.0_PUBLIC
export GHIDRA_USER_EXTENSIONS_DIR="$HOME/.config/ghidra/ghidra_12.0_PUBLIC/Extensions"
export GHIDRASSISTMCP_EXT="$GHIDRA_USER_EXTENSIONS_DIR/GhidrAssistMCP"
Import a binary and start the MCP server as a headless pre-script:
"$GHIDRA_INSTALL_DIR/support/analyzeHeadless" /tmp/ghidra-projects McpHeadless \
-import /path/to/binary \
-scriptPath "$GHIDRASSISTMCP_EXT/ghidra_scripts" \
-preScript GAMCPStartServerScript.java "host=127.0.0.1" "port=8080"
For a binary that is already imported into the project, use -process instead:
"$GHIDRA_INSTALL_DIR/support/analyzeHeadless" /tmp/ghidra-projects McpHeadless \
-process binary_name \
-scriptPath "$GHIDRASSISTMCP_EXT/ghidra_scripts" \
-preScript GAMCPStartServerScript.java "host=127.0.0.1" "port=8080"
To keep a headless MCP session open after analysis completes, run the server as a post-script with wait mode:
"$GHIDRA_INSTALL_DIR/support/analyzeHeadless" /tmp/ghidra-projects McpHeadless \
-process binary_name \
-scriptPath "$GHIDRASSISTMCP_EXT/ghidra_scripts" \
-postScript GAMCPStartServerScript.java "host=127.0.0.1" "port=8080" "wait=true"
MCP clients can connect to:
SSE: http://127.0.0.1:8080/sse
SSE messages: http://127.0.0.1:8080/message
Streamable HTTP: http://127.0.0.1:8080/mcp
The headless MCP server runs inside the analyzeHeadless JVM and uses the loaded currentProgram. The server holds a program consumer while it is running so MCP requests do not race against program database closure. Use wait=true when you want analyzeHeadless to stay open for interactive MCP clients; cancel the script or terminate the process to stop the server.
GhidrAssistMCP provides 38 tools organized into categories. Several tools use an action-based API pattern where a single tool provides multiple related operations.
| Tool | Description |
|---|---|
get_binary_info |
Get basic program information (name, architecture, compiler, etc.) |
list_binaries |
List all open programs across all CodeBrowser windows |
assemble_code |
Assemble instruction text at an address and optionally patch it into program memory |
patch_bytes |
Patch raw bytes in program memory at a given address |
export_program |
Export the current program to disk (binary or original_file) (disabled by default) |
Security-sensitive tools:
import_fileandexport_programare disabled by default because they interact with the host filesystem. Enable them explicitly in the plugin configuration UI when needed.
| Tool | Description |
|---|---|
get_functions |
List functions with optional pattern filtering and pagination |
search_functions_by_name |
Find functions by name pattern |
get_function_statistics |
Comprehensive statistics for all functions |
analyze_function |
Get detailed function information (signature, variables, etc.) |
get_current_function |
Get function at current cursor position |
get_function_stack_layout |
Get stack frame layout with variable offsets |
get_basic_blocks |
Get basic block information for a function |
create_function |
Create/define a function at an address |
disassemble_at |
Disassemble code at an address |
| Tool | Description |
|---|---|
get_imports |
List imported functions/symbols |
get_exports |
List exported functions/symbols |
get_strings |
List string references with optional filtering |
search_strings |
Search strings by pattern |
get_segments |
List memory segments |
get_namespaces |
List namespaces in the program |
get_relocations |
List relocation entries |
get_entry_points |
List all binary entry points |
| Tool | Description |
|---|---|
get_data_vars |
List data definitions in the program |
get_data_at |
Get hexdump/data at a specific address |
create_data_var |
Define data variables at addresses |
get_current_address |
Get current cursor address |
These tools bundle related operations behind a discriminator parameter (e.g., action, target, target_type, or format).
get_code - Code Retrieval Tool| Parameter | Values | Description |
|---|---|---|
format |
decompiler, disassembly, pcode |
Output format |
raw |
boolean | Only affects format: "pcode" (raw pcode ops vs grouped by basic blocks) |
classes - Class Operations Tool| Action | Description |
|---|---|
list |
List classes with optional pattern filtering and pagination |
get_info |
Get detailed class information (methods, fields, vtables, virtual functions) |
xrefs - Cross-Reference Tool| Parameter | Description |
|---|---|
address |
Find all references to/from a specific address |
function |
Find all cross-references for a func |